28 ms·
This is about authenticating consumers of an API, not end users. So while your wish is nice, it's a non sequitur here.
by cmrx64 11y ago
This is about authenticating consumers of an API, not end users. So while your wish is nice, it's a non sequitur here.
- lmm 11y agoIf we're talking about browser extensions (as the comment I replied to was) then we're talking about calls being made from the browser.
- Xorlev 11y agoFWIW, if it clarifies things, we disable shared secret auth when enabling mutual auth. At that point, you can really only call it with curl or your application.
- lmm 11y agoI'm not sure I follow. If you can use it from curl (presumably by passing the client certificate) couldn't you also use it from a browser? The browser has client certificate infrastructure, surely it can use it when making ajax requests?
- Xorlev 11y agoYou can, it just requires you to import the cert and use some pretty gnarly UI. I didn't mean to imply you couldn't use it from the browser, just that it was much less likely than curl + we rely on the cert for figuring out your account and not an API key.
- lmm 11y agoRight, which ties back into my original point. I bet there are devs using the less secure interface right now because it was easier to test in the browser that way. Good UX for certificate management in browsers would make a lot of the web more secure.